Panther informational experimental python

Snowflake User Enabled

Detect users being re-enabled in your environment

View Source

Detection Logic

def rule(_):
    return True


def title(event):
    query_text = event.get("query_text", "").split(" ")
    if len(query_text) > 2:
        return (
            f"Snowflake user [{query_text[2]}] "
            f"enabled by [{event.get('user_name','<UNKNOWN_ADMIN>')}]"
        )
    return (
        f"Snowflake user [<UNKNOWN_USER>] enabled by [{event.get('user_name','<UNKNOWN_ADMIN>')}]"
    )

Field Validations

Loading…

Comments (0)

Loading comments...